A wireless local area network (WLAN) has been increasingly applied in various working environments. Under certain situations, one WLAN needs to be divided into a plurality of virtual local area networks (VLANs). In the prior art, virtual access point (or logic access point) devices are established in one physical access point device, and then the VLANs are divided through extended service sets (ESSs), such that each VLAN corresponds to one ESS. For example, as shown in FIG. 1, two virtual access point devices AP1_a and AP1_b, as well as AP2_a and AP2_b are established in two physical access point devices AP1 and AP2, respectively, the AP1_a and the AP1_b constitute a wireless distributed system (WDS) and share a unique ESS identifier (ID) SSID1, and the AP2_a and the AP2_b constitute another WDS and share a unique ESS ID SSID2.
In an existing system (as shown in FIG. 2), as one ESS only corresponds to one VLAN, if a wireless device is switched from one VLAN to another VLAN, the connection with the ESS corresponding to the original VLAN has to be disconnected, and then the wireless device is re-associated to the ESS corresponding to the new VLAN. Meanwhile, as an independent safety strategy can be designated for each ESS, in a range covered by each ESS, a particular broadcast key for the ESS can be used to encrypt broadcast information.
As a strategy on which ESS the wireless device selects is not regulated in the prior art, the switching of the wireless device in the WLAN from one VLAN to another VLAN becomes an autonomous behavior of a client, that is, this behavior is not controlled by an external system. In the example shown in FIG. 2, if the wireless device disconnects its connection with the VLAN1 (ESS1) through an authentication, the device may still try to associate with the VLAN1 (ESS1), and even if the association is failed, the device may continuously try, such that a large amount of invalid garbage data is generated to cause additional cost to the VLAN1 (ESS1).
However, in a wired VLAN environment (as shown in FIG. 3), a device accesses the network through a switch, and after being authenticated by a back-end authentication system, the device is then switched from one VLAN to another VLAN by the switch (for example, switched from a default VLAN1 to the VLAN2 to which the device belongs). During the whole switching process, the device accessing the network may not realize that it has been switched from one VLAN to another VLAN, that is, this behavior can be controlled by an external system, and network cables do not need to be unplugged during the switching process for re-connection (i.e., the original connection does not need to be disconnected).